World
").await?; ``` +### Documents from bytes + +```rust +use markkit::{DocumentHint, Markkit}; + +let markkit = Markkit::builder().build(); +// Detection order: content type, then file extension, then magic bytes. +let hint = DocumentHint { content_type: Some("application/octet-stream"), file_name: Some("report.docx") }; +// CPU-bound: call the sync variant from `tokio::task::spawn_blocking` in async code. +let doc = markkit.extract_document_sync(&bytes, hint)?; +println!("{:?} {:?} {:?}", doc.format, doc.title, doc.warnings); +println!("{}", doc.markdown); +``` + +`Extraction` carries `markdown`, `title`, `format`, `warnings` (e.g. `truncated_sheet: …`) +and `stats` (sheets/rows/paragraphs/tables). `extract_bytes` remains as a Markdown-only +shortcut. + ### CLI ```bash @@ -105,13 +123,26 @@ let markkit = Markkit::builder() | Feature | Default | Description | |---------|---------|-------------| | `html` | Yes | HTML parsing and conversion | -| `http_client` | Yes | URL fetching via reqwest | -| `pdf` | No | PDF text extraction | -| `docx` | No | DOCX conversion | -| `spreadsheet` | No | Excel/ODS conversion | -| `all_formats` | No | Enable all format support | +| `http_client` | Yes | URL fetching via reqwest (`extract_url`) | +| `docx` | No | DOCX conversion (zip + quick-xml) | +| `spreadsheet` | No | XLSX/XLSM, XLS, ODS conversion (calamine) | +| `pdf` | No | Placeholder; PDF currently returns `UnsupportedFormat` | +| `all_formats` | No | `html`, `pdf`, `docx`, `spreadsheet` | | `logging` | No | Structured tracing output | +`http_client` is optional. Embedders that fetch content themselves can build without +reqwest (no HTTP/TLS stack in the dependency tree): + +```toml +[dependencies] +markkit = { version = "0.1", default-features = false, features = ["docx", "spreadsheet"] } +# add "html" if you also convert HTML +``` + +Office-document limits are configurable on the builder: `max_archive_entries`, +`max_archive_entry_size`, `max_archive_total_size`, `max_spreadsheet_cells`, +`max_sheet_rows`, `max_sheet_cols`, `include_hidden_sheets`. + ## Development ```bash diff --git a/crates/markkit-bench/Cargo.toml b/crates/markkit-bench/Cargo.toml index b6c978e..f5d2f4a 100644 --- a/crates/markkit-bench/Cargo.toml +++ b/crates/markkit-bench/Cargo.toml @@ -28,4 +28,4 @@ statrs = "0.18" # Terminal output colored = "3" -tabled = "0.20" +tabled = "0.22" diff --git a/crates/markkit-cli/src/main.rs b/crates/markkit-cli/src/main.rs index 06020f4..4f2742d 100644 --- a/crates/markkit-cli/src/main.rs +++ b/crates/markkit-cli/src/main.rs @@ -88,19 +88,10 @@ async fn main() -> Result<()> { } else if file { let src = source.as_deref().unwrap(); let bytes = tokio::fs::read(src).await?; - let ext = std::path::Path::new(src) - .extension() - .and_then(|e| e.to_str()) - .unwrap_or(""); - let content_type = match ext { - "html" | "htm" => Some("text/html"), - "pdf" => Some("application/pdf"), - "docx" => Some( - "application/vnd.openxmlformats-officedocument.wordprocessingml.document", - ), - _ => None, - }; - markkit.extract_bytes(&bytes, content_type).await? + // Format detected from the extension, then magic bytes. + markkit + .extract_document_sync(&bytes, markkit::DocumentHint::file_name(src))? + .markdown } else { let src = source.as_deref().unwrap(); markkit.extract_url(src).await? diff --git a/crates/markkit/Cargo.toml b/crates/markkit/Cargo.toml index d354a1d..e21e445 100644 --- a/crates/markkit/Cargo.toml +++ b/crates/markkit/Cargo.toml @@ -16,9 +16,9 @@ readme = "../../README.md" [features] default = ["html", "http_client"] html = ["dep:scraper", "dep:html5ever", "dep:lol_html"] -pdf = ["dep:pdf-extract"] -docx = ["dep:docx-rs", "dep:zip"] -spreadsheet = ["dep:calamine"] +pdf = [] +docx = ["dep:zip", "dep:quick-xml"] +spreadsheet = ["dep:calamine", "dep:zip", "dep:quick-xml", "dep:cfb"] http_client = ["dep:reqwest"] logging = ["dep:tracing", "dep:tracing-subscriber"] all_formats = ["html", "pdf", "docx", "spreadsheet"] @@ -51,15 +51,14 @@ scraper = { workspace = true, optional = true } html5ever = { workspace = true, optional = true } lol_html = { workspace = true, optional = true } -# PDF (optional) -pdf-extract = { workspace = true, optional = true } -# DOCX (optional) -docx-rs = { workspace = true, optional = true } +# Office documents (optional): DOCX + spreadsheets share the ZIP/XML stack zip = { workspace = true, optional = true } +quick-xml = { workspace = true, optional = true } # Spreadsheet (optional) calamine = { workspace = true, optional = true } +cfb = { workspace = true, optional = true } # HTTP client (optional) reqwest = { workspace = true, optional = true } @@ -73,22 +72,28 @@ tokio = { workspace = true, features = ["macros", "rt-multi-thread"] } tempfile.workspace = true proptest.workspace = true criterion.workspace = true +zip = { workspace = true } +cfb = { workspace = true } [[example]] name = "basic" path = "../../examples/basic.rs" +required-features = ["html"] [[example]] name = "custom_selectors" path = "../../examples/custom_selectors.rs" +required-features = ["html"] [[example]] name = "ir_access" path = "../../examples/ir_access.rs" +required-features = ["html"] [[example]] name = "configuration" path = "../../examples/configuration.rs" +required-features = ["html"] [[bench]] name = "extraction" diff --git a/crates/markkit/src/archive.rs b/crates/markkit/src/archive.rs new file mode 100644 index 0000000..4f3defd --- /dev/null +++ b/crates/markkit/src/archive.rs @@ -0,0 +1,132 @@ +//! Bounded ZIP access shared by the DOCX and spreadsheet parsers. +//! +//! Decision: declared sizes in ZIP headers are attacker-controlled, so limits are +//! enforced on bytes actually produced by the decompressor (`Read::take`), never on +//! header fields. [`ZipGuard::validate_all`] decompresses every entry into a sink +//! before third-party code (calamine) touches the archive, because that code reads +//! entries without limits and may follow arbitrary relationship targets. + +use std::io::{Cursor, Read}; + +use zip::ZipArchive; +use zip::result::ZipError; + +use crate::config::MarkkitBuilder; + +/// Archive failure, split so callers can map limit violations to +/// [`crate::Error::ResourceLimit`] and everything else to a format error. +#[derive(Debug)] +pub(crate) enum ArchiveError { + Limit(String), + Invalid(String), +} + +impl FromWorld
").await?; -//! assert!(md.contains("# Hello")); //! -//! // Extract from a URL +//! // Convert any supported document from bytes (format detected from the +//! // content type, then the file extension, then magic bytes). +//! let bytes = std::fs::read("report.docx")?; +//! let doc = markkit.extract_document_sync(&bytes, DocumentHint::file_name("report.docx"))?; +//! println!("{} ({}): {}", doc.title.unwrap_or_default(), doc.format, doc.markdown); +//! +//! // Extract from a URL (requires the `http_client` feature) +//! #[cfg(feature = "http_client")] //! let md = markkit.extract_url("https://example.com").await?; //! # Ok(()) //! # } @@ -25,13 +31,20 @@ //! //! ## Features //! -//! - **HTML**: Convert HTML to markdown with configurable rules -//! - **PDF**: Extract text from PDF documents (requires `pdf` feature) -//! - **DOCX**: Convert Word documents (requires `docx` feature) -//! - **Spreadsheet**: Convert Excel/ODS files (requires `spreadsheet` feature) -//! - **URL fetching**: Fetch and extract from URLs (requires `http_client` feature) +//! - **HTML** (`html`, default): Convert HTML to markdown with configurable rules +//! - **DOCX** (`docx`): Convert Word documents +//! - **Spreadsheet** (`spreadsheet`): Convert XLSX/XLSM, XLS and ODS workbooks to tables +//! - **PDF** (`pdf`): Planned; currently returns [`Error::UnsupportedFormat`] +//! - **URL fetching** (`http_client`, default): Fetch and extract from URLs via reqwest +//! +//! Embedders that do their own fetching can drop reqwest entirely: +//! `markkit = { version = "0.1", default-features = false, features = ["docx", "spreadsheet"] }`. +#[cfg(any(feature = "docx", feature = "spreadsheet"))] +mod archive; pub mod config; +#[cfg(feature = "docx")] +mod docx; pub mod error; pub mod extract; pub mod format; @@ -39,10 +52,15 @@ pub mod format; pub mod html; pub mod ir; pub mod render; +#[cfg(feature = "spreadsheet")] +mod spreadsheet; +#[cfg(feature = "docx")] +mod xml; pub use config::MarkkitBuilder; pub use error::Error; -pub use extract::Markkit; +pub use extract::{Extraction, ExtractionStats, Markkit}; +pub use format::{DocumentHint, Format}; pub use ir::Document; pub use render::MarkdownRenderer; diff --git a/crates/markkit/src/render/markdown.rs b/crates/markkit/src/render/markdown.rs index 0534f57..eec02a1 100644 --- a/crates/markkit/src/render/markdown.rs +++ b/crates/markkit/src/render/markdown.rs @@ -310,6 +310,20 @@ fn trim_trailing_inline(buf: &mut String, start: usize) { } } +/// Escape text for a GFM table cell: pipes escaped, line breaks flattened. +#[cfg(any(feature = "docx", feature = "spreadsheet"))] +pub(crate) fn escape_table_cell(s: &str) -> String { + let mut out = String::with_capacity(s.len()); + for c in s.chars() { + match c { + '|' => out.push_str("\\|"), + '\r' | '\n' => out.push(' '), + c => out.push(c), + } + } + out +} + /// Check if a node is block-level. fn is_block(node: &Node) -> bool { matches!( @@ -379,4 +393,10 @@ mod tests { // Hard break preserved assert_eq!(normalize_output("a \nb\n"), "a \nb\n"); } + + #[cfg(any(feature = "docx", feature = "spreadsheet"))] + #[test] + fn test_escape_table_cell() { + assert_eq!(escape_table_cell("a|b\r\nc"), "a\\|b c"); + } } diff --git a/crates/markkit/src/render/mod.rs b/crates/markkit/src/render/mod.rs index b91fc60..cc262f8 100644 --- a/crates/markkit/src/render/mod.rs +++ b/crates/markkit/src/render/mod.rs @@ -5,3 +5,5 @@ mod markdown; pub use markdown::MarkdownRenderer; +#[cfg(any(feature = "docx", feature = "spreadsheet"))] +pub(crate) use markdown::escape_table_cell; diff --git a/crates/markkit/src/spreadsheet.rs b/crates/markkit/src/spreadsheet.rs new file mode 100644 index 0000000..c86b04b --- /dev/null +++ b/crates/markkit/src/spreadsheet.rs @@ -0,0 +1,716 @@ +//! Spreadsheets (XLSX/XLSM, XLS, ODS) → IR via calamine. +//! +//! Decisions: +//! - The concrete reader is chosen by sniffing the container, not the caller's +//! hint: `.xls` mislabelled XLSX (and vice versa) is common on the web. +//! - calamine builds dense `Range`s sized by the bounding box of used cells, so a +//! tiny file with cells at `A1` and `XFD1048576` would allocate billions of +//! cells (and `Vec` allocation failure aborts the process). Therefore: +//! * XLSX is read through calamine's streaming cell reader — no dense grid; +//! * XLS and ODS (which eagerly build grids for every sheet on open) are +//! pre-scanned by us — BIFF records / ODF row & column repeats — and rejected +//! with `ResourceLimit` when the grid would exceed `max_spreadsheet_cells`; +//! * ZIP containers are fully validated with bounded decompression first, +//! because calamine reads entries without limits. +//! - Only cell values are read. VBA projects / XLM macro sheets are never +//! executed or rendered; dialog/macro/chart sheets are skipped. +//! - Hidden sheets are skipped by default (content invisible to a human reviewer +//! is a prompt-injection vector); opt in with `include_hidden_sheets`. +//! - XLSB is detected but not supported (no grid pre-scan implemented). + +use std::collections::BTreeMap; +use std::io::{Cursor, Read, Seek}; + +use calamine::{Data, DataRef, Ods, Reader, SheetType, SheetVisible, Xls, Xlsx}; +use quick_xml::events::{BytesStart, Event}; + +use crate::archive::{ArchiveError, ZipGuard}; +use crate::config::MarkkitBuilder; +use crate::error::Error; +use crate::format::Format; +use crate::ir::{Document, Node}; +use crate::render::escape_table_cell; + +pub(crate) struct SheetOutput { + pub doc: Document, + pub format: Format, + pub warnings: Vecx"), + Format::Html + ); + assert_eq!(Format::sniff(b"
"), Format::Html); + assert_eq!(Format::sniff(b"just text"), Format::Unknown); + assert_eq!(Format::sniff(b""), Format::Unknown); +} + +#[test] +fn ole2_sniffing_distinguishes_doc_and_xls() { + let mut cfb = b"\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1".to_vec(); + cfb.extend_from_slice(&[0u8; 100]); + let utf16 = |s: &str| { + s.encode_utf16() + .flat_map(u16::to_le_bytes) + .collect::there
", + DocumentHint::content_type("text/html"), + ); + #[cfg(feature = "html")] + { + let e = res.unwrap(); + assert_eq!(e.format, Format::Html); + assert!(e.markdown.contains("# Hi")); + } + #[cfg(not(feature = "html"))] + assert!(matches!(res, Err(Error::UnsupportedFormat(_)))); +} + +#[test] +fn extract_document_unknown_is_unsupported() { + let m = Markkit::builder().build(); + let err = m + .extract_document_sync(b"random bytes", DocumentHint::default()) + .unwrap_err(); + assert!(matches!(err, Error::UnsupportedFormat(_)), "{err:?}"); +} + +#[test] +fn extract_document_legacy_doc_and_pptx_unsupported() { + let m = Markkit::builder().build(); + for ct in [ + "application/msword", + "application/vnd.openxmlformats-officedocument.presentationml.presentation", + ] { + let err = m + .extract_document_sync(b"whatever", DocumentHint::content_type(ct)) + .unwrap_err(); + assert!(matches!(err, Error::UnsupportedFormat(_)), "{ct}: {err:?}"); + } +} + +#[test] +fn pdf_is_explicitly_unsupported_not_empty() { + let m = Markkit::builder().build(); + let err = m + .extract_document_sync(b"%PDF-1.4\n%%EOF", DocumentHint::default()) + .unwrap_err(); + assert!(matches!(err, Error::UnsupportedFormat(_)), "{err:?}"); + + let rt = tokio::runtime::Runtime::new().unwrap(); + let err = rt + .block_on(m.extract_bytes(b"%PDF-1.4", Some("application/pdf"))) + .unwrap_err(); + assert!(matches!(err, Error::UnsupportedFormat(_)), "{err:?}"); +} + +#[test] +fn max_input_size_enforced_before_detection() { + let m = Markkit::builder().max_input_size(4).build(); + let err = m + .extract_document_sync(b"too long
", DocumentHint::content_type("text/html")) + .unwrap_err(); + assert!(matches!(err, Error::ResourceLimit(_)), "{err:?}"); +} + +#[cfg(not(feature = "docx"))] +#[test] +fn docx_without_feature_is_unsupported() { + let m = Markkit::builder().build(); + let err = m + .extract_document_sync(b"PK\x03\x04", DocumentHint::file_name("a.docx")) + .unwrap_err(); + assert!(matches!(err, Error::UnsupportedFormat(_)), "{err:?}"); +} + +#[cfg(not(feature = "spreadsheet"))] +#[test] +fn spreadsheet_without_feature_is_unsupported() { + let m = Markkit::builder().build(); + let err = m + .extract_document_sync(b"PK\x03\x04", DocumentHint::file_name("a.xlsx")) + .unwrap_err(); + assert!(matches!(err, Error::UnsupportedFormat(_)), "{err:?}"); +} diff --git a/crates/markkit/tests/document_security.rs b/crates/markkit/tests/document_security.rs new file mode 100644 index 0000000..693ea25 --- /dev/null +++ b/crates/markkit/tests/document_security.rs @@ -0,0 +1,405 @@ +//! Security tests for office-document parsing: zip bombs, resource caps, +//! malformed input, XML entity tricks, oversized spreadsheet grids. + +#![cfg(any(feature = "docx", feature = "spreadsheet"))] + +mod common; + +use common::*; +use markkit::{DocumentHint, Error, Markkit}; +use proptest::prelude::*; + +const DOCX_CT: &str = "application/vnd.openxmlformats-officedocument.wordprocessingml.document"; +const XLSX_CT: &str = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"; + +fn run(m: &Markkit, bytes: &[u8], ct: &str) -> markkit::Result: "
+ pub stats: ExtractionStats, // pages / sheets / rows / paragraphs / tables (Option each)
+}
+```
+
+`extract_bytes(bytes, content_type)` delegates to `extract_document_sync` and returns
+only the Markdown. Parsing is CPU-bound; async callers should use the sync variant in
+`spawn_blocking`.
+
+Warning codes: `truncated_sheet`, `hidden_sheet_skipped`, `sheet_error`.
+
## Format Detection
-Priority order:
-1. Explicit content type parameter
-2. MIME type from HTTP headers
-3. File extension
-4. Magic bytes detection
+Priority order (`Format::detect`):
+1. Content type (`DocumentHint::content_type`; parameters ignored). Generic types such as
+ `application/octet-stream` map to `Unknown` and fall through.
+2. File extension (`DocumentHint::file_name`; URL query/fragment ignored).
+3. Magic bytes (`Format::sniff`):
+ - `PK\x03\x04` ZIP: ODF `mimetype` entry → ODS; `word/document*` → DOCX;
+ `xl/workbook.*` → XLSX; `ppt/presentation.*` → PPTX (part names are stored
+ uncompressed, so no archive parsing is needed for detection).
+ - OLE2 (`D0 CF 11 E0`): UTF-16 `WordDocument` stream → DOC; `Workbook`/`Book` → XLS.
+ - `%PDF-` within the first 1 KiB → PDF.
+ - ` 6 clamp to 6) |
+| Paragraph | Paragraph (empty paragraphs dropped) |
+| `w:b`, `w:i`, `w:strike`/`w:dstrike` (`w:val="0"/"false"` = off) | `**`, `*`, `~~`; adjacent identical runs merged, edge whitespace moved outside |
+| `w:hyperlink` (`r:id` relationship target, or `w:anchor`) | `[text](url)` / `[text](#anchor)`; spaces → `%20` |
+| `w:numPr` (direct or via style) + numbering.xml `numFmt` | `-` for `bullet`/`none`, `1.` otherwise; nested by `ilvl`; no numbering part → bullets |
+| `w:tbl` | GFM table, first row = header, `gridSpan` pads empty cells, nested tables flattened, pipes escaped |
+| `w:br` / `w:cr` | Hard line break (page/column breaks ignored); `w:tab` → space |
+| `w:ins`, `w:sdt`, `w:smartTag`, `w:customXml`, `w:fldSimple` | Unwrapped |
+| `w:del`, `w:instrText`, drawings/text boxes, comments, headers/footers, footnotes | Skipped |
+
+The main part is located through `_rels/.rels` (fallback `word/document.xml`); styles and
+numbering through the main part's relationships.
+
+## Spreadsheet Mapping
+
+- One `## ` section per non-empty worksheet, in workbook order, followed by a
+ GFM table. The first non-empty row is the header; fully empty rows and leading empty
+ columns are dropped.
+- Cells: numbers without trailing `.0` for integers; booleans `true`/`false`; dates as
+ `YYYY-MM-DD[ HH:MM:SS]`, durations `H:MM:SS`; errors as Excel shows them (`#DIV/0!`).
+ Pipes are escaped (`\|`), line breaks flattened to spaces.
+- Caps: `max_sheet_rows` (10 000 data rows) and `max_sheet_cols` (256); exceeding either
+ emits a `truncated_sheet` warning.
+- Hidden / very hidden sheets are skipped with `hidden_sheet_skipped` unless
+ `include_hidden_sheets(true)`. Chart, dialog and macro sheets are skipped.
+- Only cached cell values are read: formulas are not evaluated, VBA/XLM macros are never
+ executed or rendered.
## Resource Limits
All formats enforce:
-- Maximum input size (default: 50MB)
-- Maximum processing time (default: 60s)
-- Maximum output size (prevent markdown explosion)
+- Maximum input size (default: 50MB), checked before detection
+- Maximum processing time (default: 60s) – configuration only, enforcement TBD
+- Maximum output size (prevent markdown explosion) – bounded by the caps below
+
+Office formats additionally enforce (see `specs/threat-model.md`):
+- `max_archive_entries` (10 000), `max_archive_entry_size` (64 MiB decompressed),
+ `max_archive_total_size` (256 MiB decompressed)
+- `max_spreadsheet_cells` (4 000 000) for the dense grid calamine builds for XLS/ODS
+- XML nesting depth 256 for DOCX parts
diff --git a/specs/security.md b/specs/security.md
index ab641db..930ed84 100644
--- a/specs/security.md
+++ b/specs/security.md
@@ -19,6 +19,12 @@ Markkit processes untrusted input from the internet. Key threats:
- **Mitigation**: Private IP range blocking
- **Mitigation**: Redirect limit
+### TM-DOC: Malicious office documents
+- **Mitigation**: Bounded ZIP decompression (entry count, per-entry and total size)
+- **Mitigation**: Spreadsheet grid pre-scan / streaming (no dense-grid amplification)
+- **Mitigation**: No macro execution, no formula evaluation, hidden sheets skipped by default
+- See `specs/threat-model.md` T6
+
### TM-MEM: Memory exhaustion
- **Mitigation**: Streaming processing where possible
- **Mitigation**: Memory budgets for large documents
diff --git a/specs/threat-model.md b/specs/threat-model.md
index ed60d99..bc9f925 100644
--- a/specs/threat-model.md
+++ b/specs/threat-model.md
@@ -7,6 +7,7 @@
| HTML string input | `extract_html()`, `extract_html_sync()` | Untrusted |
| URL fetching | `extract_url()` (http_client feature) | Untrusted remote |
| Byte input | `extract_bytes()` with content-type | Untrusted |
+| Document input | `extract_document()`, `extract_document_sync()` | Untrusted (bytes and `DocumentHint`) |
| Configuration | `MarkkitBuilder` methods | Trusted (caller-controlled) |
| CSS selectors | `include_selector()`, `exclude_selector()` | Semi-trusted (caller-provided) |
@@ -108,6 +109,73 @@
- `html_security::very_long_text_node` (100KB text node)
- `html_proptest::no_panic_on_arbitrary_input`
+### T6: Malicious Office Documents (DOCX / XLSX / XLS / ODS)
+
+**Description**: Crafted containers aimed at exhausting memory/CPU, crashing the
+process, or smuggling content past a human reviewer.
+
+**Impact**: High -- OOM abort (allocation failure aborts, it cannot be caught), crash.
+
+**Likelihood**: Medium -- office files are fetched from arbitrary URLs by embedders.
+
+**Sub-threats and mitigations**:
+
+#### T6a: Zip bombs
+- Limits apply to bytes actually produced by the decompressor (`Read::take`), never to
+ attacker-controlled header sizes.
+- `max_archive_entries` (10 000), `max_archive_entry_size` (64 MiB),
+ `max_archive_total_size` (256 MiB) → `Error::ResourceLimit`.
+- DOCX reads only the parts it needs, each through the bounded reader.
+- Spreadsheets: every entry is decompressed into a sink first, because calamine reads
+ entries unbounded and may follow arbitrary relationship targets.
+
+#### T6b: Dense-grid amplification
+- calamine sizes `Range`s by the bounding box of used cells; two cells at `A1` and
+ `XFD1048576` would allocate ~17 billion cells.
+- XLSX: streamed through calamine's cell reader into a capped sparse grid (no dense
+ allocation).
+- XLS: BIFF records pre-scanned (DIMENSIONS reservations, cell positions, BOUNDSHEET
+ offsets) and rejected when the summed grid exceeds `max_spreadsheet_cells` (4M).
+- ODS: `content.xml` pre-scanned honouring row/column repeats; same cap.
+- Output caps: `max_sheet_rows` (10 000), `max_sheet_cols` (256) with
+ `truncated_sheet` warnings.
+
+#### T6c: Parser crashes on malformed input
+- XLS pre-scan rejects records that trip calamine's unchecked arithmetic (inverted
+ DIMENSIONS, inverted MULRK column ranges, out-of-range sheet offsets).
+- XML: depth capped at 256, tree built iteratively, unclosed elements tolerated.
+- Parsers run under `catch_unwind` (defence in depth; only effective with
+ `panic = "unwind"` -- the workspace release profile uses `abort`).
+
+#### T6d: XML entity attacks (billion laughs, XXE)
+- quick-xml never expands DTD-declared or external entities; such references are dropped.
+ Only the five predefined entities and character references are resolved.
+- quick-xml >= 0.41 (via calamine 0.36) fixes RUSTSEC-2026-0194 (quadratic duplicate-attribute
+ check); markkit's own XML walkers iterate attributes with `with_checks(false)` and never
+ use `NsReader` (RUSTSEC-2026-0195).
+
+#### T6e: Macros and hidden content
+- No code execution: VBA projects and XLM macro sheets are never read or rendered;
+ formulas are not evaluated (cached values only).
+- Hidden / very hidden sheets skipped by default (`hidden_sheet_skipped` warning) since
+ invisible content is a prompt-injection vector. DOCX deleted revisions and field
+ instructions are dropped.
+
+**Test Coverage** (`tests/document_security.rs`):
+- `docx_zip_bomb_entry_rejected`, `docx_total_decompressed_size_capped`,
+ `archive_entry_count_capped`, `xlsx_zip_bomb_sheet_rejected`,
+ `xlsx_bomb_in_unreferenced_entry_rejected`, `max_input_size_honoured_for_office_documents`
+- `xls_huge_dimensions_rejected`, `xls_far_apart_cells_rejected`,
+ `xls_inverted_dimensions_rejected_not_panicking`, `xls_bad_sheet_offset_rejected`,
+ `ods_repeated_rows_and_columns_rejected`,
+ `spreadsheet_integration::xlsx_sparse_far_cell_does_not_allocate_grid`
+- `docx_billion_laughs_not_expanded`, `docx_external_entity_not_resolved`,
+ `docx_deep_nesting_does_not_overflow_stack`
+- `truncated_fixtures_never_panic`, `random_bytes_never_panic`,
+ `random_container_bytes_never_panic`, `mutated_fixtures_never_panic`
+- `spreadsheet_integration::xlsx_hidden_sheet_skipped_by_default`,
+ `spreadsheet_integration::xlsm_with_vba_project_extracts_values_only`
+
### T5: Information Disclosure
**Description**: Error messages or output leak sensitive information.
@@ -128,6 +196,12 @@
| Input size | 50 MB | `max_input_size(usize)` | Before parsing |
| Processing time | 60 s | `max_processing_secs(u64)` | Config field (enforcement TBD) |
| Nesting depth | 200 | Hardcoded `MAX_DEPTH` | During HTML tree walk |
+| XML nesting depth (DOCX) | 256 | Hardcoded `MAX_XML_DEPTH` | While building the XML tree |
+| ZIP entries | 10 000 | `max_archive_entries(usize)` | On archive open |
+| ZIP entry size (decompressed) | 64 MiB | `max_archive_entry_size(u64)` | While decompressing |
+| ZIP total size (decompressed) | 256 MiB | `max_archive_total_size(u64)` | While decompressing |
+| Spreadsheet grid (XLS/ODS) | 4 000 000 cells | `max_spreadsheet_cells(u64)` | Pre-scan before calamine |
+| Rows / columns per sheet | 10 000 / 256 | `max_sheet_rows`, `max_sheet_cols` | While collecting cells (truncate + warn) |
| Output size | Unbounded | N/A | Proportional to input size |
## Malicious Input Categories
@@ -162,3 +236,7 @@
| S5 | Output is deterministic for identical input | `html_proptest::deterministic_output` |
| S6 | Deep nesting does not cause stack overflow | `html_security::deeply_nested_elements` |
| S7 | Non-content elements produce no output | `html_integration::script_stripped`, `style_stripped`, `form_elements_stripped` |
+| S8 | Archive decompression is bounded by measured output, not headers | `document_security::*zip_bomb*`, `archive_entry_count_capped` |
+| S9 | Malformed office documents produce errors, never panics | `document_security::truncated_fixtures_never_panic`, `*_never_panic` proptests |
+| S10 | Spreadsheet parsing never allocates a grid beyond `max_spreadsheet_cells` | `document_security::xls_*_rejected`, `ods_repeated_rows_and_columns_rejected` |
+| S11 | Unsupported formats fail explicitly (no empty success) | `document_detection::pdf_is_explicitly_unsupported_not_empty` |